In transactional replication with queued updates (TRQU), the Distributor needs to connect to the Publisher and Subscriber. For security, the replication agents use a special SQL Server login that SQL Server creates during the replication setup for this purpose. This login, distributor_admin, has sysadmin permissions on all SQL Server instances involved in the replication process. You can see this login in the sysxlogins table on all servers.